Information Technology Controls (IT Controls) - Revision history

User at 23:01, 21 December 2022

2022-12-21T23:01:00Z

User at 22:58, 21 December 2022

2022-12-21T22:58:49Z

Show changes

User at 12:50, 11 November 2022

2022-11-11T12:50:08Z

User at 12:57, 31 August 2021

2021-08-31T12:57:00Z

User: /* The Importance of IT ControlsWhy Are Information Technology Controls and Audit Important? IT Today */

2021-08-30T17:18:20Z

The Importance of IT ControlsWhy Are Information Technology Controls and Audit Important? IT Today

User: /* Current IT Standard/Control Frameworks and Models */

2021-08-30T17:15:45Z

Current IT Standard/Control Frameworks and Models

User: The LinkTitles extension automatically added links to existing pages (https://github.com/bovender/LinkTitles).

2021-02-06T16:33:09Z

The LinkTitles extension automatically added links to existing pages (https://github.com/bovender/LinkTitles).

Show changes

User at 17:37, 16 May 2020

2020-05-16T17:37:17Z

Show changes

User at 17:00, 16 May 2020

2020-05-16T17:00:08Z

User at 16:58, 16 May 2020

2020-05-16T16:58:22Z

← Older revision		Revision as of 23:01, 21 December 2022
Line 102:		Line 102:

	=== ITIL<ref>ITIL [https://www.cherwell.com/library/essential-guides/essential-guide-to-itil-framework-and-processes/ Cherwell]</ref> ===		=== ITIL<ref>ITIL [https://www.cherwell.com/library/essential-guides/essential-guide-to-itil-framework-and-processes/ Cherwell]</ref> ===
−	Successfully aligning customer demand and business needs with technology services offers organizations a unique opportunity to enhance efficiency, improve productivity, and increase value. Aligned organizational needs and services can lay the foundation for establishing a competitive edge and achieving business success. The ~~[[ITIL (Information Technology Infrastructure Library)~~ITIL® framework]] offers a set of [[IT Service Management (ITSM)\|ITSM]] best practices aids organizations in aligning IT service delivery with business goals. ITIL, or Information Technology Infrastructure Library, is a well-known set of IT best practices designed to assist businesses in aligning their IT services with customer and business needs. Services include IT related assets, accessibility, and resources that deliver value and benefits to customers. ITIL framework objectives include the delivery of valuable service offerings, as well as meeting customer needs, and achieving business goals of a given organization. Despite the individuality of each organization, ITIL provides guidelines for achieving these objectives and measuring success with [[Key Performance Indicator (KPI)\|KPIs]]. While it is most common to see ITIL implemented among large organizations, ITIL processes can bring value to small and mid-size organizations. Smaller organizations often implement only a subset of ITIL processes that are perceived to offer the most significant or tangible return on effort.	+	Successfully aligning customer demand and business needs with technology services offers organizations a unique opportunity to enhance efficiency, improve productivity, and increase value. Aligned organizational needs and services can lay the foundation for establishing a competitive edge and achieving business success. The ITIL® framework offers a set of [[IT Service Management (ITSM)\|ITSM]] best practices aids organizations in aligning IT service delivery with business goals. ITIL, or Information Technology Infrastructure Library, is a well-known set of IT best practices designed to assist businesses in aligning their IT services with customer and business needs. Services include IT related assets, accessibility, and resources that deliver value and benefits to customers. ITIL framework objectives include the delivery of valuable service offerings, as well as meeting customer needs, and achieving business goals of a given organization. Despite the individuality of each organization, ITIL provides guidelines for achieving these objectives and measuring success with [[Key Performance Indicator (KPI)\|KPIs]]. While it is most common to see ITIL implemented among large organizations, ITIL processes can bring value to small and mid-size organizations. Smaller organizations often implement only a subset of ITIL processes that are perceived to offer the most significant or tangible return on effort.

@@ Line 154: / Line 154: @@
 [[IT Infrastructure]]<br />
 [[IT Investment Management (ITIM)]]<br />
 [[IT Management (Information Technology Management)]]<br />
 [[IT Maturity Model]]<br />

@@ Line 1: / Line 1: @@
 == Definition of Information Technology Controls (IT Controls)<ref>Definition - What Does Information Technology Controls (IT Controls) Mean? [https://chapters.theiia.org/montreal/ChapterDocuments/GTAG%201%20-%20Information%20technology%20controls_2nd%20ed.pdf IIA]</ref> ==
-'''Information Technology Controls (IT Controls)''' are essential to protect assets, [[Customer|customers]], partners, and sensitive information; demonstrate safe, efficient, and ethical behavior; and preserve [[Brand|brand]], reputation, and trust. In today’s global [[market]] and regulatory environment, these things are too easy to lose.
+'''Information Technology Controls or IT Controls''' are essential to protect assets, [[Customer|customers]], partners, and sensitive information; demonstrate safe, efficient, and ethical behavior; and preserve [[Brand|brand]], reputation, and trust. In today’s global [[market]] and regulatory environment, these things are too easy to lose.
 IT controls do not exist in isolation. They form an interdependent continuum of protection, but they also may be subject to compromise due to weak links. IT controls are subject to error and [[management]] override, range from simple to highly technical, and exist in a dynamic environment. IT controls have two significant elements:

@@ Line 29: / Line 29: @@
 Unfortunately, as with any breakthrough in technology, advancements have also given rise to various new problems that must be addressed, such as security and privacy. These problems are often being brought to the attention of IT audit and control specialists due to their impact on public and private organizations. Current legislation and government plans will effect the online community and, along with the government's role in the networked society, will have a lasting impact in future business practices.
-IT and information security are integral parts of the IT's internal controls. The computer is changing the world. [[Business Operations|Business operations]] are also changing, sometimes very rapidly, because of the fast continuing [[improvement]] of technology. Events such as September 11, 2001, and financial upheavals from corporate scandals such as Enron and Global Crossing have resulted in increased awareness. Yes, IT controls are very important. Today, people are shopping around at home through networks. People use "numbers" or accounts to buy what they want via shopping computers. These "numbers" are "digital money," the modern currency in the world. Digital money will bring us benefits as well as problems. One major benefit of digital money is its increased efficiency. However, it will also create another problem for us. "Security" is perhaps the biggest factor for individuals interested in making online purchases by using digital money. Also, it must be remembered that vigilance needs to be maintained over those who use the [[Internet]] for illegal activities, including those who are now using it for scams, crime, and covert activities that could potentially cause loss of life and harm to others. IT control and security is everyone's business.
+IT and information security are integral parts of the IT's [[Internal Control|internal controls]]. The computer is changing the world. [[Business Operations|Business operations]] are also changing, sometimes very rapidly, because of the fast continuing [[improvement]] of technology. Events such as September 11, 2001, and financial upheavals from corporate scandals such as Enron and Global Crossing have resulted in increased awareness. Yes, IT controls are very important. Today, people are shopping around at home through networks. People use "numbers" or accounts to buy what they want via shopping computers. These "numbers" are "digital money," the modern currency in the world. Digital money will bring us benefits as well as problems. One major benefit of digital money is its increased efficiency. However, it will also create another problem for us. "Security" is perhaps the biggest factor for individuals interested in making online purchases by using digital money. Also, it must be remembered that vigilance needs to be maintained over those who use the [[Internet]] for illegal activities, including those who are now using it for scams, crime, and covert activities that could potentially cause loss of life and harm to others. IT control and security is everyone's business.
 == The Hierarchy of IT Controls<ref>The Hierarchy of IT Controls [https://www.slideshare.net/arsantander/information-technology-controls-29119410 David A Richards et al.]</ref> ==

@@ Line 82: / Line 82: @@
 == Current IT Standard/Control Frameworks and Models ==
-Several popular IT Governance and Standards Frameworks are displayed in Figure 1: COSO; CobiT; ITIL, and ISO 27001/9000. While no one [[framework]] or model encompasses all of the possible IT controls, collectively they cover the “what, how, and scope” of [[IT Governance]] — albeit with some duplication and overlap.
+Several popular [[IT Governance]] and Standards Frameworks are displayed in Figure 1: [[COSO Internal Control Integrated Framework]]; [[COBIT (Control Objectives for Information and Related Technology)]]; [[ITIL (Information Technology Infrastructure Library)]], and ISO 27001/9000. While no one [[framework]] or model encompasses all of the possible IT controls, collectively they cover the “what, how, and scope” of [[IT Governance]] — albeit with some duplication and overlap.
@@ Line 128: / Line 128: @@
 *ISO 9000:2005 - Fundamentals and vocabulary
 *ISO 9001:2015 - Requirements
 *ISO 9004:2000 - Guidelines for performance improvement
 == See Also ==

@@ Line 106: / Line 106: @@
-=== ISO 27001<ref>ISO 27001 [https://www.itgovernance.co.uk/blog/iso-27001-the-14-control-sets-of-annex-a-explained itgovernance.co.uk]</ref> === ISO 27001 is the international standard that describes best practice for an ISMS (information security management system). The Standard takes a risk-based approach to information security. This requires organisations to identify information security risks and select appropriate controls to tackle them. Annex A of ISO 27001 provides an essential tool for managing security. It provides a list of security controls to be used to improve the security of information. As you can see from the list below, ISO 27001 is not fully focused on IT, while IT is very important, IT on its own cannot protect information. Instead, bringing together Physical security, HR management, organisational issues and legal protection, along with IT are required to secure the information. A useful way to understand Annex A is to think of it as a catalogue of security controls – based on your risk assessments, you should then select the ones that are applicable to your organisation and tie into your statement of applicability. The 14 control sets of Annex A:
+=== ISO 27001<ref>ISO 27001 [https://www.itgovernance.co.uk/blog/iso-27001-the-14-control-sets-of-annex-a-explained itgovernance.co.uk]</ref> ===
 *A.5 Information security policies (2 controls): how policies are written and reviewed.
 *A.6 Organisation of information security (7 controls): the assignment of responsibilities for specific tasks.

← Older revision		Revision as of 16:58, 16 May 2020
Line 121:		Line 121:
	*A.17 Information security aspects of business continuity management (4 controls): how to address business disruptions.		*A.17 Information security aspects of business continuity management (4 controls): how to address business disruptions.
	*A.18 Compliance (8 controls): how to identify the laws and regulations that apply to your organisation.		*A.18 Compliance (8 controls): how to identify the laws and regulations that apply to your organisation.
		+
		+
		+	=== ISO 9000<ref>ISO 9000 [https://www.iso-9001-checklist.co.uk/iso-9000-standards.htm ISO 9001 Checklist]</ref> ===
		+	ISO 9000 is a family of internationally accepted standards that are used to measure the quality management system (QMS) followed by an organization. The main purpose of the ISO 9000 standard is to provide a time-tested framework to help companies establish and follow a systematic approach for managing organizational processes for rendering consistent quality. ISO 9000 is often used to refer to a family of three standards:
		+	*ISO 9000:2005 - Fundamentals and vocabulary
		+	*ISO 9001:2015 - Requirements
		+	*ISO 9004:2000 - Guidelines for performance improvement